Advert.

Do NOT tell your scammer he is posted here, or report their accounts as it puts others at risk!

"Identity Theft Protection"<IdentityTheftProtection@pp.com>

For the reports that have information missing.

"Identity Theft Protection"<IdentityTheftProtection@pp.com>

Unread postby SlapHappy » Sat Nov 17, 2012 10:34 pm

* 216.199.84.58 Umbach Financial Group Llc- Wpb / Ins West Palm Beach United States
202.218.32.248 Joe's Web Hosting Kanamachi Japan
*Probable originating IP address

Sat, 17 Nov 2012 13:00:42 -0800 (PST)
Return-Path: <IdentityTheftProtection@pp.com>
Received: from server.ranx-auto.com ([202.218.32.248])
by mx.google.com with ESMTPS id iw4si8013106pbc.81.2012.11.17.13.00.41
(version=TLSv1/SSLv3 cipher=OTHER);
Sat, 17 Nov 2012 13:00:42 -0800 (PST)
Received-SPF: neutral (google.com: 202.218.32.248 is neither permitted
nor denied by best guess record for domain of
IdentityTheftProtection@pp.com) client-ip=202.218.32.248;
Authentication-Results: mx.google.com; spf=neutral (google.com:
202.218.32.248 is neither permitted nor denied by best guess record
for domain of IdentityTheftProtection@pp.com)
smtp.mail=IdentityTheftProtection@pp.com
Message-Id:
<50a7fafa.c4c5440a.5b9d.ffffbb9fSMTPIN_ADDED@mx.google.com>
Received: from [216.199.84.58] (helo=User)
by server.ranx-auto.com with esmtpa (Exim 4.63)
(envelope-from <IdentityTheftProtection@pp.com>)
id 1TZpUl-0004CO-MX; Sun, 18 Nov 2012 06:00:11 +0900
Reply-To: <No-reply@thank.you>
From: "Identity Theft Protection"<IdentityTheftProtection@pp.com>
Subject: Please understand that this is a security measure intended to help
protect you and your account.
Date: Sat, 17 Nov 2012 16:00:00 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0035_01C2A9A6.3393BE42"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-AntiAbuse: This header was added to track abuse, please include it with any
abuse report
X-AntiAbuse: Primary Hostname - server.ranx-auto.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [0 0] / [47 12]
X-AntiAbuse: Sender Address Domain - pp.com

This is a multi-part message in MIME format.

------=_NextPart_000_0035_01C2A9A6.3393BE42
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit


Dear PayPal Customer,


You have added angelina1974@comcast.com as a new email address for your Paypal account.

If you did not authorize this change, check with family members and others who may have access to your account first. If you still feel that an unauthorized person has changed your email, submit the form attached to your email in order to keep your original email and restore your Paypal account.

NOTE: The form needs to be opened in a modern browser which has javascript enabled (ex: Internet Explorer 7, Firefox 3, Safari 3, Opera 9)

Please understand that this is a security measure intended to help protect you and your account. We apologize for any inconvenience.

If you choose to ignore our request, you leave us no choice but to temporary suspend your account.


Sincerely, PayPal Account Review Department.

Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your PayPal account and choose the "Help" link in the footer of any page.


Copyright © 1999-2011 PayPal. All rights reserved.

Personal Profile Form - PayPal-.htm << Phishing form. Do not open!
49K
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

"Privacy Policy"<Admin@ppmanager.com> Important Notification

Unread postby SlapHappy » Mon Nov 19, 2012 6:37 am

Same email text and phishing form attachment. Different headers.

* 216.199.84.58 Umbach Financial Group Llc- Wpb / Ins West Palm Beach United States
38.126.9.175 Cogent Communications Chicago United States

*Probable originating IP address

Received: by 10.50.152.236 with SMTP id vb12mr4973464igb.15.1353272813208;
Sun, 18 Nov 2012 13:06:53 -0800 (PST)
Return-Path: <Admin@ppmanager.com>
Received: from cpanel.africa-insites.com (cpanel.africa-insites.com. [38.126.9.175])
by mx.google.com with ESMTPS id t6si6585702igb.3.2012.11.18.13.06.51
(version=TLSv1/SSLv3 cipher=OTHER);
Sun, 18 Nov 2012 13:06:53 -0800 (PST)
Received-SPF: neutral (google.com: 38.126.9.175 is neither permitted nor denied by
best guess record for domain of Admin@ppmanager.com) client-ip=38.126.9.175;
Authentication-Results: mx.google.com; spf=neutral (google.com: 38.126.9.175 is
neither permitted nor denied by best guess record for domain of Admin@ppmanager.com)
smtp.mail=Admin@ppmanager.com
Message-Id: <50a94ded.e60b320a.0f74.7d7cSMTPIN_ADDED_MISSING@mx.google.com>
Received: from 216.199.84.58.nw.nuvox.net ([216.199.84.58]:60703 helo=User)
by cpanel.africa-insites.com with esmtpa (Exim 4.80)
(envelope-from <Admin@ppmanager.com>)
id 1TaC4n-0000Cd-2x; Sun, 18 Nov 2012 15:06:49 -0600
Reply-To: <NoReply@ppmanager.com>
From: "Privacy Policy"<Admin@ppmanager.com>
Subject: Important Notification - Please Review
Date: Sun, 18 Nov 2012 16:06:39 -0500
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.

<NoReply@ppmanager.com> <Admin@ppmanager.com>

Unread postby SlapHappy » Tue Nov 20, 2012 8:08 pm

* 198.144.153.137 Yesup Ecommerce Solutions Toronto Canada
178.19.106.210 Livenet Sp. Z O.o. Tarnowskie Góry Poland
*Probable originating IP address

Tue, 20 Nov 2012 10:22:58 -0800 (PST)
Return-Path: <Admin@ppmanager.com>
Received: from server.renhost.pl (server.renhost.pl. [178.19.106.210])
by mx.google.com with ESMTPS id l45si22941700eep.39.2012.11.20.10.22.57
(version=TLSv1/SSLv3 cipher=OTHER);
Tue, 20 Nov 2012 10:22:58 -0800 (PST)
Received-SPF: neutral (google.com: 178.19.106.210 is neither permitted nor denied
by best guess record for domain of Admin@ppmanager.com) client-ip=178.19.106.210;
Authentication-Results: mx.google.com; spf=neutral (google.com: 178.19.106.210 is
neither permitted nor denied by best guess record for domain of
Admin@ppmanager.com) smtp.mail=Admin@ppmanager.com
Message-Id: <50abca82.45db0e0a.2ef8.2c6dSMTPIN_ADDED@mx.google.com>
Received: from [198.144.153.137] (helo=User)
by server.renhost.pl with esmtpa (Exim 4.76)
(envelope-from <Admin@ppmanager.com>)
id 1Tarx6-0004wB-In; Tue, 20 Nov 2012 18:49:43 +0100
Reply-To: <NoReply@ppmanager.com>
From: "Admin@ppmanager.com"<Admin@ppmanager.com>
Subject: Important Notification - Please Review
Date: Tue, 20 Nov 2012 10:22:48 -0800
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_008A_01C2A9A6.31508FAC"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

This is a multi-part message in MIME format.

------=_NextPart_000_008A_01C2A9A6.31508FAC
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit

Same email text and attachment.
If anyone asks you for money on the Internet they are always a scammer, 100% of the time.
Blackmail Scammed? Go here: https://www.scamsurvivors.com/blackmail/#/
FAQ viewtopic.php?f=3&t=19
Victim of a scam? Go here: https://scamsurvivors.com/forum/viewtop ... =3&t=26504
User avatar
SlapHappy
Retired admin/co creator
 
Posts: 44968
Joined: Tue Apr 17, 2012 5:18 am
Location: Just a face in a magazine, watching you post your scammer's details.


Return to Reports with missing information.

Who is online

Users browsing this forum: No registered users and 15 guests